Title: [145630] branches/safari-536.30-branch
- Revision
- 145630
- Author
- [email protected]
- Date
- 2013-03-12 17:25:17 -0700 (Tue, 12 Mar 2013)
Log Message
Merged r136060. <rdar://problem/13334905>
Modified Paths
Added Paths
Diff
Modified: branches/safari-536.30-branch/LayoutTests/ChangeLog (145629 => 145630)
--- branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 00:18:25 UTC (rev 145629)
+++ branches/safari-536.30-branch/LayoutTests/ChangeLog 2013-03-13 00:25:17 UTC (rev 145630)
@@ -1,5 +1,19 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r136060
+
+ 2012-11-28 Abhishek Arya <[email protected]>
+
+ Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer
+ https://bugs.webkit.org/show_bug.cgi?id=101970
+
+ Reviewed by David Hyatt.
+
+ * fast/block/float/float-not-removed-from-pre-block-expected.txt: Added.
+ * fast/block/float/float-not-removed-from-pre-block.html: Added.
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r135794
2012-11-26 Daniel Bates <[email protected]>
Copied: branches/safari-536.30-branch/LayoutTests/fast/block/float/float-not-removed-from-pre-block-expected.txt (from rev 136060, trunk/LayoutTests/fast/block/float/float-not-removed-from-pre-block-expected.txt) (0 => 145630)
--- branches/safari-536.30-branch/LayoutTests/fast/block/float/float-not-removed-from-pre-block-expected.txt (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/block/float/float-not-removed-from-pre-block-expected.txt 2013-03-13 00:25:17 UTC (rev 145630)
@@ -0,0 +1,3 @@
+Bug 101970: Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer
+Test passes if it does not crash.
+
Copied: branches/safari-536.30-branch/LayoutTests/fast/block/float/float-not-removed-from-pre-block.html (from rev 136060, trunk/LayoutTests/fast/block/float/float-not-removed-from-pre-block.html) (0 => 145630)
--- branches/safari-536.30-branch/LayoutTests/fast/block/float/float-not-removed-from-pre-block.html (rev 0)
+++ branches/safari-536.30-branch/LayoutTests/fast/block/float/float-not-removed-from-pre-block.html 2013-03-13 00:25:17 UTC (rev 145630)
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<html>
+Bug 101970: Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer<br />
+Test passes if it does not crash.<br />
+<div id="container">
+ <q>
+ <q id="test1"></q>
+ </q>
+ <q id="test2">
+ <q style="float: left"></q>
+ <q id="test3">
+ <q style="position: fixed;">
+ </q>
+ </q>
+</div>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+document.body.offsetTop;
+test3.style.display = "table-footer-group";
+test3.focus();
+test1.style.display = "table-row-group";
+test2.style.display = "inline-block";
+</script>
+</html>
Modified: branches/safari-536.30-branch/Source/WebCore/ChangeLog (145629 => 145630)
--- branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-13 00:18:25 UTC (rev 145629)
+++ branches/safari-536.30-branch/Source/WebCore/ChangeLog 2013-03-13 00:25:17 UTC (rev 145630)
@@ -1,5 +1,36 @@
2013-03-12 Lucas Forschler <[email protected]>
+ Merge r136060
+
+ 2012-11-28 Abhishek Arya <[email protected]>
+
+ Heap-use-after-free in WebCore::RenderLayerModelObject::hasSelfPaintingLayer
+ https://bugs.webkit.org/show_bug.cgi?id=101970
+
+ Reviewed by David Hyatt.
+
+ RenderInline::splitFlow and RenderBlock::splitFlow re-use |pre|
+ block in some cases. In those cases, |pre| might hold floating objects
+ and those floating descendants might get moved to |post| block. If
+ the |pre| block does not get a layout later, then the floating
+ descendant will never get removed since it is now part of |post|
+ ancestor chain. We don't want failing-to-layout bugs turned into
+ security bugs and hence clear floating objects list since we expect
+ it to be rebuilt in subsequent layout.
+
+ Test: fast/block/float/float-not-removed-from-pre-block.html
+
+ * rendering/RenderBlock.cpp:
+ (WebCore::RenderBlock::splitFlow): Call removeFloatingObjects on |pre| block.
+ (WebCore::RenderBlock::removeFloatingObjects): Clear all floating objects from our list.
+ (WebCore):
+ * rendering/RenderBlock.h:
+ (RenderBlock):
+ * rendering/RenderInline.cpp:
+ (WebCore::RenderInline::splitFlow): Call removeFloatingObjects on |pre| block.
+
+2013-03-12 Lucas Forschler <[email protected]>
+
Merge r135719
2012-11-26 Florin Malita <[email protected]>
Modified: branches/safari-536.30-branch/Source/WebCore/rendering/RenderBlock.cpp (145629 => 145630)
--- branches/safari-536.30-branch/Source/WebCore/rendering/RenderBlock.cpp 2013-03-13 00:18:25 UTC (rev 145629)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/RenderBlock.cpp 2013-03-13 00:25:17 UTC (rev 145630)
@@ -673,6 +673,7 @@
// We can reuse this block and make it the preBlock of the next continuation.
pre = block;
pre->removePositionedObjects(0);
+ pre->removeFloatingObjects();
block = toRenderBlock(block->parent());
} else {
// No anonymous block available for use. Make one.
@@ -3603,6 +3604,15 @@
removePositionedObject(deadObjects.at(i));
}
+void RenderBlock::removeFloatingObjects()
+{
+ if (!m_floatingObjects)
+ return;
+
+ deleteAllValues(m_floatingObjects->set());
+ m_floatingObjects->clear();
+}
+
RenderBlock::FloatingObject* RenderBlock::insertFloatingObject(RenderBox* o)
{
ASSERT(o->isFloating());
Modified: branches/safari-536.30-branch/Source/WebCore/rendering/RenderBlock.h (145629 => 145630)
--- branches/safari-536.30-branch/Source/WebCore/rendering/RenderBlock.h 2013-03-13 00:18:25 UTC (rev 145629)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/RenderBlock.h 2013-03-13 00:25:17 UTC (rev 145630)
@@ -105,6 +105,8 @@
static void removePositionedObject(RenderBox*);
void removePositionedObjects(RenderBlock*);
+ void removeFloatingObjects();
+
TrackedRendererListHashSet* positionedObjects() const;
bool hasPositionedObjects() const
{
Modified: branches/safari-536.30-branch/Source/WebCore/rendering/RenderInline.cpp (145629 => 145630)
--- branches/safari-536.30-branch/Source/WebCore/rendering/RenderInline.cpp 2013-03-13 00:18:25 UTC (rev 145629)
+++ branches/safari-536.30-branch/Source/WebCore/rendering/RenderInline.cpp 2013-03-13 00:25:17 UTC (rev 145630)
@@ -418,6 +418,7 @@
// We can reuse this block and make it the preBlock of the next continuation.
pre = block;
pre->removePositionedObjects(0);
+ pre->removeFloatingObjects();
block = block->containingBlock();
} else {
// No anonymous block available for use. Make one.
_______________________________________________
webkit-changes mailing list
[email protected]
https://lists.webkit.org/mailman/listinfo/webkit-changes
